Article View: comp.security.misc
Article #1088Re: ISPs can easily decrease net abuse
From: Walter Roberson
Date: Tue, 02 Dec 2003 03:59
Date: Tue, 02 Dec 2003 03:59
23 lines
2447 bytes
2447 bytes
In article <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com>, booster <saltynuts2002@msn.com> wrote: :ipv6 isn't only about shortage.. it has better security and a host of :features too. For example you can't do ipsec over NAT. NAT is a hack and we :all know hacks will burn you sooner or later You *can* do IPSec over NAT. IPSec defines multiple layers: the payload itself (possibly encrypted), encryption headers (ESP), and authentication headers (AH). AH is optional, and if you don't have it turned on, then you can still use the authentication layer that ESP provides for the payload; AH adds authentication of the IP addresses themselves. It was not possible before to do AH over NAT, but there is now a draft IETF "UDP Encpasulation of IPSec Packets", http://www.ietf.org/html.charters/ipsec-charter.html This UDP encapsulation routine -automatically- detects whether one or both ends of the link are undergoing NAT, and does encapsulation via UDP 4500 only if necessary. -- "There are three kinds of lies: lies, damn lies, and statistics." -- not Twain, perhaps Disraeli, first quoted by Leonard Courtney
Technical Details
Message-ID:
<bqh2nb$6en$1@canopus.cc.umanitoba.ca>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!newsfeed2.dallas1.level3.net!news.level3.com!news-out.visi.com!petbe.visi.com!newsfeed.news2me.com!snoopy.risq.qc.ca!torn!canopus.cc.umanitoba.ca!not-for-mailReferences:
<Xns944467F028317jbuserspc9org@130.179.16.24> <5P-dnfb30tlQI1aiRVn-sA@giganews.com> <pyRyb.4717$zf2.611681@news20.bellglobal.com> <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: 10c8f2,17f958067a510d3b X-Google-Attributes: gid10c8f2,public X-Google-Thread: ff723,17f958067a510d3b X-Google-Attributes: gidff723,public X-Google-ArrivalTime: 2003-12-01 19:59:40 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!newsfeed2.dallas1.level3.net!news.level3.com!news-out.visi.com!petbe.visi.com!newsfeed.news2me.com!snoopy.risq.qc.ca!torn!canopus.cc.umanitoba.ca!not-for-mail From: roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson) Newsgroups: comp.security.misc,can.internet.highspeed Subject: Re: ISPs can easily decrease net abuse Date: 2 Dec 2003 03:59:39 GMT Organization: National Research Council Canada - Conseil national de rechereches Canada Lines: 23 Message-ID: <bqh2nb$6en$1@canopus.cc.umanitoba.ca> References: <Xns944467F028317jbuserspc9org@130.179.16.24> <5P-dnfb30tlQI1aiRVn-sA@giganews.com> <pyRyb.4717$zf2.611681@news20.bellglobal.com> <0TTyb.118354$Fv8.114900@twister01.bloor.is.net.cable.rogers.com> NNTP-Posting-Host: zeno.ibd.nrc-cnrc.gc.ca X-Trace: canopus.cc.umanitoba.ca 1070337579 6615 192.70.172.132 (2 Dec 2003 03:59:39 GMT) X-Complaints-To: Postmaster@cc.umanitoba.ca NNTP-Posting-Date: 2 Dec 2003 03:59:39 GMT Originator: roberson@ibd.nrc-cnrc.gc.ca (Walter Roberson)